CrowdStrike details ClickFix attacks and strategies to mitigate user-executed threats

ClickFix attacks represent a sophisticated social engineering technique that exploits user behavior to execute malicious commands on their systems. Observed by CrowdStrike Intelligence, these attacks have been linked to threat actors such as STARDUST CHOLLIMA and VOODOO BEAR, highlighting a significant rise in incidents involving fake CAPTCHA lures, which increased by 563% in 2025 according to the CrowdStrike 2026 Global Threat Report. This article delves into the mechanics of ClickFix, its operational implications, and the strategies CrowdStrike employs to mitigate these user-executed threats.

Understanding ClickFix

ClickFix operates by presenting users with a seemingly legitimate problem that requires their intervention. Instead of tricking individuals into opening a malicious attachment, it convinces them to execute a command themselves. The “error” message might suggest that a meeting application needs repair or that a CAPTCHA must be completed. The ultimate goal is to transfer malicious instructions from a compromised webpage into a trusted operating system tool.

A typical ClickFix attack unfolds in several stages:

1. The adversary creates the problem: Victims land on a compromised site displaying a fake error or CAPTCHA, often reached through phishing emails or targeted techniques.
2. The website provides the “solution”: Users are instructed to copy a command, sometimes facilitated by malicious JavaScript that automatically places the command on their clipboard.
3. The user crosses the security boundary: Victims paste the command into trusted system utilities like Windows Run or PowerShell.
4. The operating system executes the attacker’s instructions: This may involve launching PowerShell or VBScript to retrieve or execute additional payloads.
5. The initial command becomes an intrusion: Subsequent actions can include malware deployment, credential theft, and further access into the environment.

Why ClickFix Is Effective

The effectiveness of ClickFix lies in its ability to exploit common user behaviors. Employees frequently encounter technical issues related to meetings, authentication, and application errors. A prompt suggesting a quick troubleshooting step can appear less suspicious than an unexpected executable or email attachment. Furthermore, ClickFix leverages trusted tools within the operating system, making it easier for users to comply with the request.

Unlike traditional phishing, which often relies on getting users to download or open malicious files, ClickFix requires victims to actively execute commands, thereby bypassing security measures designed to detect harmful files. The adaptability of the lure is another advantage; adversaries can quickly change domains, impersonate different brands, or switch the nature of the fake error while maintaining the same underlying technique.

Case Studies: STARDUST CHOLLIMA and VOODOO BEAR

In a notable incident involving STARDUST CHOLLIMA, CrowdStrike Intelligence observed a ClickFix scenario targeting an employee at a financial services entity. The employee encountered a fake technical issue while attempting to join a video meeting, which led to the execution of a command that triggered a PowerShell and VBScript-based infection chain, deploying two previously unknown malware families: GeniexLoader and GeniexRAT.

Similarly, VOODOO BEAR demonstrated the versatility of ClickFix by using fake CAPTCHAs as a lure. In mid-2026, CrowdStrike detected intrusions affecting Ukrainian employees at organizations in France, the United States, and Canada. The adversary compromised Ukrainian websites to serve fake CAPTCHAs, tricking users into executing PowerShell commands that downloaded a VBScript payload. Despite the different lures, the core mechanism remained consistent: converting browser interactions into endpoint execution.

Mitigating ClickFix Attacks

Addressing ClickFix attacks requires a multifaceted approach, as they blur the lines between phishing, browser activity, and endpoint execution. CrowdStrike’s Falcon platform offers several layers of defense:

• Before execution: Falcon Seraphic Enterprise Browser enhances visibility and enforcement within the browser, disrupting the copy-and-paste mechanism that ClickFix relies on.
• At execution: Falcon® Prevent and Falcon® Insight XDR can identify and prevent suspicious activities associated with the attack chain.
• After initial access: Falcon® Identity Threat Protection detects and stops credential abuse and lateral movement, while Falcon® Next-Gen SIEM correlates activity across various telemetry sources.

This layered defense strategy ensures that if one stage of the attack succeeds, additional opportunities exist to prevent, detect, and respond to the intrusion as it progresses.

Conclusion

Defending against ClickFix attacks necessitates more than just user education about suspicious URLs or commands. Organizations must implement comprehensive controls that disrupt the initial lure, prevent malicious execution, and monitor for credential abuse. By integrating Falcon Seraphic Enterprise Browser into the CrowdStrike Falcon® platform, organizations can extend protection from the initial browser interaction through to endpoint execution and identity abuse, effectively breaking the attack chain before it escalates into a breach.

For further insights into the evolving landscape of cybersecurity threats, visit CrowdStrike’s detailed analysis on how ClickFix attacks operate and the strategies to counter them.